Embed Notice

@soatok

The NSA is handicapped by being a dual-mission agency. The same organisation is responsible for:

• Making sure that the USA's signals are secure.
• Making sure that no other country's signals are secure from the USA.

These are in obvious tension when the USA and everyone else are using the same off-the-shelf standards and implementations of those standards.

I'm generally happy that they now prioritise the former over the latter, if only because they now know that there is a good chance that any weakness that they put in will be exploited by the Chinese, but I'd be a lot more comfortable if they properly separated the two concerns.

I am still curious about Heartbleed because a lot of the US government was vulnerable and I know the NSA did some review of OpenSSL, so I don't know which of the following options was true:

• They didn't bother to review a core piece of security-critical software that a lot of the government's security depended on (I have some evidence that it wasn't this one).
• They did review it and missed a really important bug.
• They did review it, found the bug, and made a staggeringly bad call about whether it was better to fix the bug or keep it as a thing to attack other people with.

None of these possibilities makes them look especially competent.